Bifrost turns 1! Get 30% off annual plans with code
HAPPYBIRTHDAY

Security Policy

How to report a security vulnerability in NativePHP, Bifrost or a plugin.

Please don't disclose security issues publicly.

Don't open a public issue, pull request or discussion for a vulnerability. Report it privately using one of the options below.

All security vulnerabilities will be promptly addressed. Where you report one depends on what it affects.

Open source packages

For NativePHP's open source packages, use GitHub's private Report a vulnerability form on the package's repository. Only the maintainers can see what you send, and we can work on a fix with you there before anything is made public.

Core

Mobile plugins

Tools and starter kits

Bifrost, this website and private plugins

Email [email protected] about vulnerabilities in Bifrost or nativephp.com, and in NativePHP's own plugins that aren't open source.

Third-party plugins

Plugins made by other developers are maintained by their authors, so report vulnerabilities in them to the author. Every plugin's page in the plugin directory lists its support contact.

If you can't reach the author, or you think a plugin is malicious, use the report form on the plugin's page so the NativePHP team can step in.

What to include

  • The package, service or plugin affected, and its version.
  • A description of the vulnerability and its impact.
  • Steps to reproduce it, or a proof of concept.